release: WRNexusJS 0.8.2

packages/dev-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/dev-server",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/dev-server/src/runtime.ts

@@ -959,7 +959,9 @@ export function createHandlers(deps: RuntimeDeps): Handlers {
       return secure(await readinessHandler(req));
     }
     if (webVitalsEnabled && url.pathname === webVitalsEndpoint) {
-      return secure(await webVitalsHandler(req));
+      // Validate same-origin telemetry against the proxy-resolved public URL,
+      // rather than the internal listener URL used by the hosting platform.
+      return secure(await webVitalsHandler(new Request(url, req)));
     }
     if (webVitalsEnabled && url.pathname === "/__wrnexus/vitals.js") {
       return secure(

packages/dev-server/test/observability-runtime.test.ts

@@ -3,7 +3,7 @@ import { HealthRegistry } from "@wrnexus/core";
 import type { Router } from "@wrnexus/router";
 import { createHandlers, type RuntimeDeps } from "../src/runtime.ts";
 
-function runtime(health: HealthRegistry) {
+function runtime(health: HealthRegistry, trustProxy = false) {
   const router: Router = {
     pages: [],
     api: [],
@@ -25,7 +25,8 @@ function runtime(health: HealthRegistry) {
     getMiddleware: async () => [],
     assets: { serve: async () => null },
     health,
-    observability: { enabled: true, sampleRate: 1, exporter: "none" },
+    security: { trustProxy },
+    observability: { enabled: true, webVitals: true, sampleRate: 1, exporter: "none" },
   } satisfies RuntimeDeps);
 }
 
@@ -45,6 +46,24 @@ test("runtime exposes separate liveness and dependency readiness probes", async
   expect(await ready?.json()).toEqual({ status: "down" });
 });
 
+test("accepts same-origin vitals behind a trusted HTTPS proxy", async () => {
+  const handlers = runtime(new HealthRegistry(), true);
+  const response = await handlers.fetch(
+    new Request("http://internal:3000/__wrnexus/metrics/vitals", {
+      method: "POST",
+      headers: {
+        origin: "https://wrnexusjs.dev",
+        "x-forwarded-host": "wrnexusjs.dev",
+        "x-forwarded-proto": "https",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({ name: "LCP", value: 1200, route: "/packages" }),
+    }),
+    server,
+  );
+  expect(response?.status).toBe(204);
+});
+
 test("built production responses carry the framework security-header baseline", async () => {
   const handlers = runtime(new HealthRegistry());
   const response = await handlers.fetch(new Request("https://example.test/healthz"), server);